how to stop Whm/cpanel from broadcasting user names?

Spammers send spam to username@domain.com

I've found ways of solving that problem, here and abroad, however, one thing that has bothered me is how the spammers get the "username" in the first place. The clients username should be protected just like their password.

But somehow whm/cpanel seems to be broadcasting this information. I have setup test accounts with jibberish usernames and sure enough it'll start getting spam if I don't take care of it.

So how do we stop cpanel/whm from providing a list of user names on the box?